PAN-SA-2025-0005: GlobalProtect Clientless VPN: Clientless VPN Misconfiguration Allows Cross-Site Attacks

Published Feb 12, 2025

Updated

Palo Alto Networks GlobalProtect Clientless VPN is intended to provide secure remote access to trusted internal applications. It is not meant to provide access to the Internet, intranet or multiple websites.

When the Clientless VPN is misconfigured to allow access to the Internet or any internal website, it allows malicious scripts on one site to obtain sensitive information or modify content of any application accessible through the VPN including Clientless VPN itself.

For further details about the risks of Clientless VPNs please refer to https://www.kb.cert.org/vuls/id/261869

Affected Software

3 affected components

Palo Alto Networks Cloud NGFW

Palo Alto Networks PAN-OS

Palo Alto Networks Prisma Access

Remediation

Mitigation

The Clientless VPN feature only ensures secure remote access to a single trusted application. Ensure that the Clientless VPN access is limited by Security Policies to a single trusted site. Refer to the Configure Clientless VPN page for additional details. For accessing multiple applications, since the Same-Origin Policy is not enforced, we strongly recommend configuring access to only trusted pages through Clientless VPN. Clientless VPN should never be used to allow access to the internet or intranet. If you need to secure access to untrusted websites, please consider the following alternatives: * GlobalProtect App (https://docs.paloaltonetworks.com/globalprotect) * Supported Third Party VPN Client (https://docs.paloaltonetworks.com/compatibility-matrix/reference/globalprotect/what-x-auth-ipsec-clients-are-supported) * Prisma Access Browser (https://docs.paloaltonetworks.com/prisma-access-browser) * Web Proxy (https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/networking-features/web-proxy) (Note: Web Proxy can only be used to improve web browsing safety. It cannot be used as a VPN.)

Event History

Feb 12, 2025

Advisory Published

via Palo Alto Networks·05:00 PM

Data Sourced

via Palo Alto Networks·05:00 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of PAN-SA-2025-0005?

The severity of PAN-SA-2025-0005 is considered high due to the potential for unauthorized access to the Internet.

How do I fix PAN-SA-2025-0005?

To fix PAN-SA-2025-0005, ensure that the GlobalProtect Clientless VPN is properly configured to limit access only to trusted internal applications.

What products are affected by PAN-SA-2025-0005?

PAN-SA-2025-0005 affects Palo Alto Networks Cloud NGFW, PAN-OS, and Prisma Access.

What vulnerability does PAN-SA-2025-0005 address?

PAN-SA-2025-0005 addresses a misconfiguration issue that may allow unauthorized Internet access through the Clientless VPN.

Is there a workaround for PAN-SA-2025-0005?

A workaround for PAN-SA-2025-0005 is to restrict access to the Clientless VPN settings to prevent Internet access.